Creating a probe instance
You can create a probe instance to monitor network traffic seen on a network adapter, explore saved packet captures, and have multiple people be able to see the captured data from their copy of Observer. Create a passive or active probe instance depending on what your goals are.
Prerequisite: Multi or Expert Probe.
When you open Observer for the first time, you assign memory to a probe instance. You can choose to use this one probe instance, or you can create other probe instances. Multiple probe instances are useful if you need multiple users using the same probe simultaneously or if you have specific needs for each probe instance (for instance, packet capture, trending, and so on). See Configuring connections to multiple NICs or Observer for why you would want to use multiple probe instances.
Note: There are several different probe instance types. These include a packet capture-based probe instance used to capture packet traffic, two NetFlow collectors, an sFlow collector, and an MPLS probe. This section describes creating a packet-based probe instance, but the process is similar for the other probe instances, some of which are only available on the Expert Probe. For NetFlow, see Creating a NetFlow collector or NetFlow Trending collector. For MPLS, see Creating and configuring an MPLS probe instance. For sFlow, see .
To set up a probe instance, follow these steps:
1. Do one of the following:
On the probe: Click the Adapters and Redirection tab.
In Observer: Select a probe instance, right-click and choose Administer Selected Probe. Then click the Adapters and Redirection tab.
2. In the upper left, click New Instance. The Edit Probe Instance wizard opens.
If the New Instance button is grayed out, it probably means you do not have enough Observer-allocated memory to add another instance.
If you get a message that says that there is not enough reserved memory to create a probe instance, you must reduce the amount of memory used by another probe instance. By default all of the reserved memory on a GigaStor is assigned to the “Instance 1” active instance. By releasing some of the reserved memory you re-allocate memory from one probe to the pool of reserved memory from which you can create other probe instances, including passive probe instances on the GigaStor. Click the Configure Memory button and reduce the amount of memory for the packet capture buffer.
You must have a minimum of 256 MB RAM to run the probe with a single instance, plus 12 MB for each additional probe instance. See Setting the total system memory reserved for probes for details on allocating memory for Observer probes.
3. Ensure “Probe” is selected in the Instance type. Type a name and description and click Next.
4. Choose an appropriate capture buffer size given the local system's available memory and how much traffic you plan on capturing from the given network.
Statistical reporting uses different memory—and much less of it—than packet capture.
Although it is possible to customize the amounts of memory used by various Observer statistical displays (by choosing a statistics memory configuration), for most situations the defaults work perfectly well. For additional information, see Customizing statistics and capture buffers for probe instances.
a. If you need to create your own memory configuration, click New. The New Statistics Memory Configuration window opens.
b. Type a name and choose a default memory configuration to use. Click Finish. After choosing the memory configuration, you can change how the memory is allocated.
c. Select your newly created memory configuration and click Edit. The Edit Statistics Memory Configuration window opens.
d. Choose your network type. For each Observer statistic, choose how much memory is allocated for it. Click OK.
e. Click Next to continue, and the Select Network Adapter and Redirection configuration dialog is displayed
5. Ensure the correct network adapter is selected and type the IP address of your Observer. Click Finish.